Developer Tools
Is direnv safe for project secrets? What direnv allow really does
direnv loads an .envrc on entry, and direnv allow is the trust step. Learn what it protects against, what it misses, and how to use it safely.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Is curl pipe to shell OK for an internal tool installer?
A one-line installer is convenient and runs unreviewed code as the user. How to keep the convenience with a readable script, checksum and fixed version.
Oct 19, 20264 min read
Developer Tools
Is CI time your vulnerability remediation bottleneck?
Slow or flaky CI can cap how many security fixes ship each week. How to spot it and the practical ways to cut waiting without cutting tests.
Oct 19, 20264 min read
Developer Tools
Is an ESLint plugin trusted code? What loads when you lint
An ESLint plugin is a JavaScript module imported by your config and run in your lint job. Treat plugin additions as dependency changes with code execution.
Oct 19, 20264 min read
Developer Tools
Is an automatic fix claim proof that fixes get merged?
A product that generates fixes has not shown that teams merge them. Ask for opened, passed, merged and reverted counts, and run a small trial of your own.
Oct 19, 20263 min read
Developer Tools
Is allowUntrustedServer safe for a Gradle remote build cache?
No. Gradle's docs call it a security risk because any server can impersonate your cache. Learn the safer fix for certificates and push rules.
Oct 19, 20263 min read
Developer Tools
Is a thin wrapper module around one Terraform resource worth it?
HashiCorp advises against modules that only wrap a single resource type. A quick test, when a wrapper is still reasonable, and the review cost it adds.
Oct 19, 20264 min read
Developer Tools
Is a /metrics endpoint safe to expose to the internet?
A metrics endpoint can reveal routes, versions, error rates and internal names. Here is what it leaks, how Kubernetes guards its own and how to lock yours.
Oct 19, 20264 min read
Developer Tools
Is a patch version bump safe? How npm, Go and Python differ
A patch bump is supposed to be safe, but ecosystems differ on what the numbers promise. What each one signals and how to test a fix accordingly.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.